Description
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete() skips the PrivilegeUtil.checkAndGetByUuid() ownership check, removing owners' workflows.
Published: 2026-10-09
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Deletion
Action: Apply Patch
AI Analysis

Impact

The vulnerability in ruoyi-ai allows an authenticated user to delete another user’s workflow via the POST /workflow/del/{uuid} endpoint because the softDelete() method skips ownership checks. This missing authorization flaw lets attackers fully remove others’ workflow artifacts, thereby compromising the integrity and availability of workflow data. The impact is limited to data loss and disruption of workflow processing rather than broader system compromise.

Affected Systems

The affected product is ruoyi-ai from ageerle, specifically versions 3.0.0 through 3.1.0. The flaw exists in the WorkflowController and WorkflowService modules, which together expose a workflow management API that lacks proper authorization validation on deletion actions.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the system and discover a workflow UUID via GET /workflow/search, then invoke POST /workflow/del/{uuid}. The missing call to PrivilegeUtil.checkAndGetByUuid() on delete allows the removal of any workflow, making exploitation straightforward for authenticated users. Because no public exploits are known, the exploitation likelihood remains moderate, but the potential for data loss persists.

Generated by OpenCVE AI on October 9, 2026 at 16:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ruoyi-ai to a release that implements proper ownership checks on the delete endpoint. Be sure to verify that the patch includes the missing PrivilegeUtil.checkAndGetByUuid() call in the workflow deletion logic.
  • If an immediate upgrade is not possible, modify the delete endpoint to enforce ownership validation—explicitly check that the caller is the workflow owner or has elevated privileges before performing the soft delete. This can be achieved by reintroducing the PrivilegeUtil.checkAndGetByUuid() call or an equivalent authorization check.
  • Configure the application to log all delete attempts and monitor the logs for unauthorized activity, alerting administrators whenever a workflow deletion occurs that does not belong to the authenticated owner.

Generated by OpenCVE AI on October 9, 2026 at 16:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
References

Tue, 13 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
References

Fri, 09 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Ageerle
Ageerle ruoyi-ai
Vendors & Products Ageerle
Ageerle ruoyi-ai

Fri, 09 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete() skips the PrivilegeUtil.checkAndGetByUuid() ownership check, removing owners' workflows.
Title ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint
First Time appeared Pandarobot
Pandarobot ruoyi Ai
Weaknesses CWE-862
CPEs cpe:2.3:a:pandarobot:ruoyi_ai:*:*:*:*:*:*:*:*
Vendors & Products Pandarobot
Pandarobot ruoyi Ai
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Ageerle Ruoyi-ai
Pandarobot Ruoyi Ai
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-14T16:04:26.608Z

Reserved: 2026-10-09T13:44:40.884Z

Link: CVE-2026-108112

cve-icon Vulnrichment

Updated: 2026-10-14T15:52:06.861Z

cve-icon NVD

Status : Deferred

Published: 2026-10-09T16:17:26.767

Modified: 2026-10-14T16:17:31.913

Link: CVE-2026-108112

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T16:45:09Z

Weaknesses